If he lost the phone, how can he install the app? Yeah, he can send it but it must be open and preconfigured right?

From the website:

No pre installation required

You didn't install AndroidLost on your phone? No problem! You can push the AndroidLost app to your phone from google market and initiate the connection to googles servers by sending an SMS with the message "androidlost register" to your phone.

Along with the above, iirc, Avast for Android can remotely wipe the device, if you sign into the Google account that is live on his device, then goto the Google Play Store and hit install on Avast, if it is powered on, it will install to the device too

It hooks into the SMS system therefor it "runs" when it's installed, int he way that the SMS service will push sms notifications to the app even if it's not running and thus start it, the app then look at the sms it's received and checks if it has the right "code word" if it doesn't it ignores it it, if it does, it wipes.

So even if the phone is off right now, it could wipe on first startup, if the app gets installed before the sms is received or the app also gets pushed previous sms'.

of course if they turned off the phone and removed the sim, yeah you're lost.